JumpList Automatic Files

Overview

Evidence: JumpList Automatic Files Description: Collect JumpList AutomaticDestination files Category: File System Platform: Windows Short Name: jlauto Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): Yes

Background

AutomaticDestination Jump Lists track recent items for applications and provide insight into user file access patterns.

Data Collected

This collector gathers structured data about AutomaticDestination files.

JumpList Automatic Files Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Path	File path	C:\...\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms
AppID	Application ID	1b4dd67f29cb1962
AppIDDescription	Application description	Microsoft Edge
Version	JumpList version	1
NumEntries	Number of entries	10
NumPinnedEntries	Number of pinned entries	3
LastEntryNumber	Last entry number	10

Collection Method

This collector parses the necessary data from the jumplist_automatic_files table and collects files from:

• %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\

Usage

Use to reconstruct file access timelines and application usage patterns.

Notes

AppIDs can be mapped to applications using known lists.